Working with UPX - Manual Unpacking with IDA Pro, x32dbg and Scylla

Summary

This video tutorial offers an in-depth look at unpacking UPX-packed executables. It begins with a simple 'Hello World' program, demonstrating how it's packed and unpacked using UPX. The presenter then explores tools like PE Studio and IDA Pro to analyze the executable's structure and memory map. The video delves into unpacking techniques, including using UPX itself and more complex methods involving debuggers like x32dbg and Skyla for memory dumping. It concludes with practical advice on dealing with modified UPX Packers and emphasizes the importance of unpacking for malware analysis.

Takeaways

• 😀 The video provides an introduction to UPX, a popular executable packer used for compressing and obfuscating executables.
• 🛠 The presenter demonstrates how to create a simple 'Hello World' program in C and compile it into an executable.
• 🔍 The video explains the use of tools like Detective Easy and PE Studio to analyze the structure of a Portable Executable (PE) file, including its sections and entry points.
• 📚 The presenter discusses the concept of packing executables with UPX, highlighting its use for both legitimate software distribution and malware obfuscation.
• 🔑 The video shows how to pack an executable using UPX and the changes that occur in the PE file structure, such as altered section names and entry points.
• 🔍 The presenter uses tools to analyze packed executables, noting the high entropy and self-modifying code characteristics that indicate UPX packing.
• 🛡 The video addresses the challenge of unpacking UPX-packed executables, especially when UPX has been modified to evade simple unpacking methods.
• 🛠 The presenter outlines a method for unpacking UPX-packed executables using UPX itself, demonstrating the process with a sample file.
• 💻 The video introduces advanced techniques for unpacking modified UPX packers, including using debuggers like x32dbg and tools like Skyla to dump executables from memory.
• 🔎 The presenter shares insights on identifying and following execution flows in packed executables to find unpacking breakpoints, which is crucial for unpacking and analysis.
• 🔧 The video concludes with a discussion on the limitations of unpacking tools and the necessity of manual analysis to fully understand and unpack modified UPX-packed executables.

Q & A

What is UPX and what does it do?

UPX (Ultimate Packer for eXecutables) is a software tool that compresses executable files, making them smaller in size for easier distribution. It also provides a layer of obfuscation, which can be used for both legitimate software protection and malicious purposes to hide the true nature of a file.

Why would someone use UPX to pack an executable?

UPX can be used to pack an executable for several reasons: to reduce the file size for easier and faster distribution, to provide a basic layer of protection or obfuscation, and to make analysis more difficult for reverse engineers or malware analysts.

How does the presenter demonstrate the creation of an executable from a C file in the video?

The presenter demonstrates creating an executable by using the 'CL' command on a simple C file that prints 'Hello World'. This is done through a developer command prompt, which compiles the C file into an executable file named 'hello.exe'.

What tools does the presenter use to analyze the structure of the PE (Portable Executable) file format?

The presenter uses two tools to analyze the PE file structure: Detective Easy and PE Studio. These tools help in examining the entry point, sections, and memory map of the executable.

What are the common sections found in a Microsoft-compiled executable as mentioned in the script?

The common sections found in a Microsoft-compiled executable include '.text', '.rdata', '.data', '.relock', and '.reloc'. These sections are typical in the PE file format.

How does UPX change the structure of an executable?

When an executable is packed with UPX, the structure changes significantly. The entry point is altered, and new sections named 'upx0', 'upx1', and 'upx2' are introduced. The original content of the executable is compressed and packed inside these new sections, making it harder to analyze directly.

What is the easy way to unpack an executable packed with UPX as described in the video?

The easy way to unpack an executable packed with UPX is to use the UPX tool itself with the '-d' argument followed by the name of the packed executable. This will create an unpacked version of the original file.

What complications might arise when trying to unpack a modified UPX packed executable?

Complications can arise if the UPX packer has been modified, which might prevent the easy unpacking method from working. In such cases, more advanced techniques, such as using a debugger to set breakpoints and dump the executable from memory, may be required.

How does the presenter use a debugger to unpack a modified UPX packed executable?

The presenter uses a debugger like X32dbg to set a breakpoint at the entry point of the packed executable. By running the executable in the debugger and allowing it to hit the breakpoint, the unpacking process begins. The presenter then uses a tool like Skyla to dump the executable from memory, which results in an unpacked version of the file.

What are the potential issues when dumping an executable from memory using tools like Skyla?

Potential issues when dumping an executable from memory include incorrect realignment of sections to their raw offsets, unresolved imports, and the possibility that the dumped executable may not run correctly due to modifications made during the unpacking process.